# title
MandateShield Execution Permit JWT Claims v1

# description
Strict decoded claims for an ES256 compact JWT whose protected header is alg=ES256, typ=MSP+JWT and contains a retained MandateShield JWKS kid. Signature verification alone never grants provider submission; the compact token must be claimed online exactly once.

# $comment
Conforming validators additionally enforce nbf <= iat < exp, exp - iat <= 60, settlement_deadline >= exp, exact audience equality and the documented SHA-256 cross-field bindings. JSON Schema cannot express every cross-field invariant.

# properties.aud.description
One exact PROCESSOR audience. JWT audience arrays are not accepted.

# properties.exp.description
JWT NumericDate. Normatively no more than 60 seconds after iat; validators must enforce the cross-field lifetime rule.

# properties.scope.description
The permit can authorize only the exact bound submission.

# properties.settlement_deadline.description
Execution settlement deadline as a whole-second Unix timestamp. A permit never extends it.

# properties.max_uses.description
Normative one-use limit. Only the online atomic claim proves whether this use is still available.

# properties.one_use_enforced.description
The signed offline artifact cannot prove one-use state. Only a fresh atomic online redemption can return provider_submission_permitted=true.

# $defs.payee.properties.destination_digest.description
SHA-256 of the exact UTF-8 destination string; validators must recompute it.